From 44967116953f3e0a0b47e43e419fcc18de289ae3 Mon Sep 17 00:00:00 2001
From: niksis02 <sisnikoyan@gmail.com>
Date: Thu, 20 Mar 2025 18:19:14 +0400
Subject: [PATCH] fix: Adds check for the final chunk signature in signed chunk
 encoding without trailing headers.

Fixes #1147

The final chunk header with 0 length, contains the last signature in signed chunk encoding implementation.
Added this last signature verification in the signed chunk encoding without trailers.
---
 s3api/utils/signed-chunk-reader.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/s3api/utils/signed-chunk-reader.go b/s3api/utils/signed-chunk-reader.go
index 1d983865..0f03c0ff 100644
--- a/s3api/utils/signed-chunk-reader.go
+++ b/s3api/utils/signed-chunk-reader.go
@@ -176,7 +176,19 @@ func (cr *ChunkReader) parseAndRemoveChunkInfo(p []byte) (int, error) {
 	if err != nil {
 		return 0, err
 	}
+	// If we hit the final chunk, calculate and validate the final
+	// chunk signature and finish reading
 	if chunkSize == 0 {
+		cr.chunkHash.Reset()
+		chunkhash := cr.chunkHash.Sum(nil)
+
+		sigstr := getChunkStringToSign(cr.strToSignPrefix, cr.prevSig, chunkhash)
+		cr.prevSig = hex.EncodeToString(hmac256(cr.signingKey, []byte(sigstr)))
+
+		if cr.prevSig != cr.parsedSig {
+			return 0, s3err.GetAPIError(s3err.ErrSignatureDoesNotMatch)
+		}
+
 		return 0, io.EOF
 	}